Messages in this thread | | | Date | Fri, 14 Mar 2008 12:28:19 +0300 | From | Pavel Emelyanov <> | Subject | Re: [RFC] cgroups: implement device whitelist lsm (v2) |
| |
Serge E. Hallyn wrote: > Quoting James Morris (jmorris@namei.org): >> On Thu, 13 Mar 2008, Serge E. Hallyn wrote: >> >>> Quoting James Morris (jmorris@namei.org): >>>> On Thu, 13 Mar 2008, Serge E. Hallyn wrote: >>>> >>>>> True, but while this change simplifies the code a bit, the semantics >>>>> seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y >>>>> and: >>>>> >>>>> SECURITY=n or >>>>> rootplug is enabled >>>>> capabilities is enabled >>>>> smack is enabled >>>>> selinux+capabilities is enabled >>>> Well, this is how real systems are going to be deployed. >>> Sorry, do you mean with capabilities? >> Yes. >> >> All Fedora, RHEL, CentOS etc. ship with SELinux+capabilities. I can't >> imagine not enabling them on other kernels. >> >>>> It becomes confusing, IMHO, if you have to change which secondary LSM you >>>> stack with SELinux to enable a cgroup feature. >>> So you're saying selinux without capabilities should still be able to >>> use dev_cgroup? (Just making sure I understand right) >> Nope, SELinux always stacks with capabilities, so havng the cgroup hooks >> in capabilities makes sense (rather than having us change the secondary >> stacking LSM just to enable a feature). > > Oh, ok. > > Will let the patch stand until Pavel and Greg comment then.
Well, I saw your previous patch, that was implemented as just another LSM module and I liked it except for the LSM dependency.
Since this version can happily work w/o LSM, I like it too :)
> thanks, > -serge >
| |